a
qqe @ s d dl Z d dlmZmZ ddlmZ ddlmZ ddlm Z ddl
m Z dd l m
Z
mZ d
Zd Zd Zd
ZdZdZG dd de ZdS ) N)ListUnion )InvalidCheckValue) AnyRBACRule)
RBACRuleQuery )
CheckerModule)ConfigDescriptorConfigSetDescriptorsourcetarget
exempt_source
exempt_target
expect_source
expect_targetc s e Zd ZdZdZeeeee e
e fZ e
dZe
dZeddddZeddddZeddddZeddddZdd fd d
Zedd d Z ZS )
AssertRBACz?Checker module for asserting a RBAC allow rule exists (or not).Z assert_rbacZ lookup_roleFT)strictexpandN)returnc s t ||| tt| _|t| _|t | _
|t | _ |t
| _|t| _|t| _t| j| j
fs|td| j | j@ }|r| jdddd |D | j| j@ }|r| jdddd |D d S )Nz5At least one of source or target options must be set.z.Overlap in expect_source and exempt_source: {}z, c s s | ] }|j V qd S Nname.0i r @/usr/lib64/python3.9/site-packages/setools/checker/assertrbac.py ; z&AssertRBAC.__init__..z.Overlap in expect_target and exempt_target: {}c s s | ] }|j V qd S r r r r r r r @ r )super__init__loggingZ getLogger__name__logget
SOURCE_OPTr
TARGET_OPTr
EXEMPT_SRC_OPTr EXEMPT_TGT_OPTr EXPECT_SRC_OPTr EXPECT_TGT_OPTr anyr infoformatjoin)selfpolicyZ checknameZconfigZ source_exempt_expect_overlapZ target_exempt_expect_overlap __class__r r r! ( s,
zAssertRBAC.__init__c
C s& | j d t| j| j| jdd}t| j}t| j}g }t |
D ]x}t|j }t|j }||8 }||8 }|| j | j r|| j | j
r| t| || qF| t| qF|D ]"}d|} | | || q|D ]"}d|} | | || q| j d| |S )Nz#Checking RBAC allow rule assertion.)Zallow)r r
Zruletypez)Expected rule with source "{}" not found.z)Expected rule with target "{}" not found.z
{} failure(s))r$ r- r r1 r r
setr r sortedresultsr r r Zlog_failstrappendZlog_okr. debug)
r0 queryZunseen_sourcesZunseen_targetsZfailuresZruleZsrcsZtgtsitemZfailurer r r runB s<
zAssertRBAC.run)r#
__module__ __qualname____doc__Z
check_type frozensetr& r' r( r) r* r+ Z check_configr
r r
r r r r r r! r r<
__classcell__r r r2 r r s
r )r" typingr r exceptionr Z policyrepr Z
rbacrulequeryr Z
checkermoduler Z descriptorsr
r r& r' r( r) r* r+ r r r r r s